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Derived properties of a locale can be proved using the lemma command. For example, the following 
commands prove that a carrier set has at least one element. 


lemma (in carrier) witness: 
“(daeacS)” 
apply Uinsert non_empty) 
apply (auto) 
done 


This result can now be used freely to show other properties of the carrier locale or indeed of the 
relation locale which inherits all of the properties of its parent locale. 


Additionally, entailment relations can be shown between locales, demonstrating that all properties of 
the one are also properties of the other. For example, the following reformulation of the relation locale 
can be shown to be an interpretation of the original. That is to say that any structure satisfying the 
properties of relation‘ also satisfies those of relation. 


locale relation’ = carrier + 


fixes 
Rs: “(a xX a) set” 
assumes 


bound_domain: “dom R Cc 8” and 
bound_range: “ran K C$” 


interpretation relation’ C relation 
proof (auto simp add: relation_axioms_def) 
fix ab 
assume b1: “(abe b) € R” 
from b! bound_domain show “a < S” 
by (auto) 
from bI bound_range show “b <« S$” 
by (auto) 
qed 


A brief discussion of Isabelle proof conventions is now in order. Proofs are either simple or com- 
pound. Simple proofs consist of a sequence of proof methods that are applied to the proof state to 
discharge the proof goal. If there is just one method, the “by” command is used. If more than one, a 
series of “apply” commands is used, terminated by a “done” command. Compound proofs also involve 
the application of methods to transform the proof state, but include explicit statements of the local proof 
goals that establish the higher level goal. Compound proofs are enclosed between “proof” and “qed” 
commands. 


The locale mechanism is useful in a number of ways. 


It provides a logically safe modelling environment in that it 1s logically separated from the underlying 
Isabelle/HOL formalism. Creating or combining locales with inconsistent assumptions does not lead to 
a collapse of the underlying formalism, since all locale results are predicated on the satisfaction of the 
locale assumptions. 
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Pisure 1: PART] System Overview 


3.1 Onutflows 


The outflow of the PAR subsystem consists of parmmm time-varying beams of microwave enerey. 


locale PARTI conat_parnum = 
fixes parnum :: “Tl” 
locale PARTI con_parbeame = 
fixes parbeams :: “[fime, WM] 4 volume” (“parbearns”) 


Por the purposes of describing the safety architecture of the PARTL we find it convenient to ap- 
proximate the notion of beam as a cylindrical volume of space emanating from an origin point on the 
ownship. 


consts 
beam :: “TE, tornt, point] point set” 


def’s 
beam def: 
“beam Ww Py Po = (LL) gleetalaeho... i] + P+ atm — Fire 
(@leqrt (fo Aehl agate, - hj) =00e7+ Fh" 


locale PARTI constorigin = 
fixes origin :: “point 
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PARTI 


Figure 2: PARTI System Boundary 


The width of the radar beams is parbw. 


locale PARTI_const_parbw = 
fixes parbw :: “R” 


The overall pattern of radiation from the PAR is then the union of the volumes irradiated by the 
individual beams. 


locale PARTI_con_radiates = PARTI_const_parnum + PARTLcon_parbeams + 
fixes 
radiates :: “R.— volume” (“radiates”) 
defines 
radiates_def: “radiates = (A t e (() r|r< parnum e parbeams tr))” 


Similarly, the outflows from the laser illuminator consist of Jasnum beams of laser light energy. We 
require that there be no more laser beams than there are radar beams as each laser beam requires a 
dedicated PAR beam to ensure accurate illimation of the target. 


locale PARTI_const_lasnum = PARTI_const_parnum + 
fixes 
Jasnum :: “WN” 
assumes 
lasnum_le_parnum: “Iasnum < parnum” 


locale PARTLcon_lasbeams = 
fixes 
Jasbeams :: “[IR, N] — volume” (“lasbeams”) 


locale PARTI_con_illuminates = PARTLconst_lasnum + PARTIcon_lasbeams + 
fixes 
illuminates :: “R. — volume” (“illuminates”) 
defines 
illuminates_def; “illuminates 2 (4 te (\J 1 | 1 < Jasnum e lasbeams t 1))” 


We also require that the width of the laser beams is no greater than the width of the radar beams. 


locale PARTI_const_lasbw = PARTLconst_parbw + 
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fixes 
lasbw :: “R” 
assumes 
lasbw_le_parbw: “|lasbw| < |parbw\” 


This ensures the the laser beams are always entirely contained in the corresponding radar beam. 


lemma (in PARTIE const tasbw) lasb_in_parb: 
“beam lasbw p PB’ C beam parbw p p'” 
proof 


Follows directly from the smaller radius of the laser beams. 
fix ¢ 
assume b1: “¢ ¢ beam lasbw pf p’” 
then obtain o 7? where 
b2: “ae FO...14”° “Z= p+ ap’ — p)” and 
b3: “sqrt (FOr) < |lasbw|” and 
b4: “fo(p — Bp’) = 0” and 
bs: “g@=Z74+ 7" 
by (auto stmp add: beam_def) 
from lasbw_le_parbw b3 
have b6: “sqrt (FO?) < |parbw|” 
by (auto) 
from b2 b6 b4 b5 
show “¢ < beam parbw p p 
apply (simp add: beam_def ) 
apply (rule exf) 
apply (inference) 
apply (witness “z,.’”) 
apply (witness “z,”’) 
apply (witness “Z,”’) 
apply Gnference) 
apply (rule reff) 
apply (auto) 
apply (witness “?,”") 
apply (witness “7,”’) 
apply (witness “7,’’) 
apply (auto) 
done 
qed 


far 


The final outflow from the PARTI is in the form of targeting control messages to the companion 
missile system. These messages are of two forms: the acquire message says that a given object is now 
being illuminated and conveys its current position; while the release says that the object is no longer 
being illuminated. 
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4 System Safety Requirements 


Buteterre analysis has wdentitied a number of potential accadent scenarios uerolving the radar laser, 
ate GoTo atone fumetorns of the PARTY system. 

The rocst serios of these scenarios are shown in Figure 4, 3,6 ard 7, using the worrentiore de- 
scahed in Bizare 3, Factors in accident scenarios Tay cornpase either events (square boxes) or states 
(round bores); which may be either internal (ooloured yellow) or external fooloured white), Accident 
araTits are show ined, Factors Toay be ar rrerated either im coruncton (and rate syrobol) or cisyumece 
fon (or- gate syroibol) and sequenced with arrows, Green dower asow labels on tramation arrorars ibe ate 
ashrnated levels of rtigation against the labelled transition, Finally the assessed default are reatg ated 
DvceR Levers ate paesercted in square brackets beside the relevant accident, 


Mote, that the danger levels associated with these accident scenarios weld adystern Danger Level of 
D4. vaquiring a fully fortoal treatioent of the System Archotectise Analysis, Thos wea perform with the 
we of [sabellefHOL as described above, 


These scenarios iirolys five different hazards, 


HAA A The PAR iracdates a paolibited area, 
HAAR The laser urinates a non-target obyact, 


HAA The PARTI sends an erroneous wore: aor 
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Figure 3: Laser related Accident Scenarios 
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HAZ_D The laser fails to maintain target illumination. 


HAZ_E The PARTI operates without command authorisation. 


For the PARTI system to be acceptably safe, it must be engineered so as not to exhibit any of these 
hazards. 


As a first step in this engineering process, we develop a collection of System Safety Requirements 
(SSRs) that are mutually consistent and complete with respect to the identified hazards. In principle, the 
SSRs may be the simple negation of the hazard conditions. In practise, interactions with other safety 
requirements and operational requirements can often mean that it desirable to adopt a more sophisticated 
collection of SSKs. 


4.1 HAZA 


In the case of HAZ_A, the situation is relatively straightforward. The negation of the hazard 1s that 
at all times the intersection of the radiated volume with the prohibited areas is empty. This creates some 
tension with the operational objective to track and illumimate all incoming threats, in particular for threats 
that are occluded by prohibited areas. However, it seems reasonable to believe that this factor will be 
taken into consideration when determining and setting the prohibited areas. We therefore resolve the 
conflict in favour of safety considerations and adopt the obvious SSR. This formalised as SSR_A below. 


4.2 HAZ B 


As 1s clear from the various accident scenarios, HA/_B has considerable interactions with the other 
hazards. There is also a strong tension with the operational imperative to track and illuminate all in- 
coming threats. The PARTI system cannot be allowed to act safely by simply never operating the laser 
illuminator, as a simple negation of HAZ_B would allow. It is necessary for the SSKs to provide some 
direction as to how to resolve this tension. 


Three scenarios of interest arise in relation to HAZ B. 


In the first the non-target is illuminated when there is no legitimate target and hence the laser should 
not be illuminating at all. This is a clear safety violation. 


In the second, there is a legitimate target, but the laser 1s incorrectly oriented so that a non-target 1s 
instead illuminated. Again, this is a clear safety violation. 


In the third, there is again a legitimate target, but the laser is occluded trom illuminating it by a 
non-target which is therefore illuminated instead (see Figure 5a). In this case, the PARTI is pursuing 
a legitimate operational objective, that it cannot ignore, but is then confronted with a safety conflict 
that also cannot be ignored. We resolve this conflict by requirmg the PARTI to communicate a release 
message before the non-target can occlude the target. 


Thus all scenarios lead to the requirement that the laser never illuminate a non-target object. This 1s 
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formalised as SSR_B below. In addition, the third scenario leads to a requirement that the PARTI stops 
targeting a threat when it loses line-of-sight to the threat. This is formalised as SSR_E below. 


4.3 HAZ C 


The communications hazard, HAZ_C, is particularly vague, especially in its role in AS_C_2, wherein 
some unspecified illegal communication causes the Combat Management System to malfunction. For the 
purposes of formulating a corresponding SSR, it 1s easiest to identify what constitutes a legal message. 


This is straightforward for target acquire messages, which can only be sent when the PARI is 
authorised to operate and for nearby objects that are threats with properly determined positions. This is 
formalised as SSR_C below. 


Unfortunately, the legality of target release messages is again complicated by operational consider- 
ations. Clearly a target release can only be sent subsequent to a prior target acquire message and only 
provided that a target release has not already been sent. Additionally, operational considerations re- 
quire that the PARTI does not communicate target release unless the target is indeed released and further 
that the target not be released until either: the target 1s destroyed, line-of-sight is lost to the target, or 
command authorisation to the PARTI is lost. Such operational considerations on target release overlap 
strongly with related safety requirements on laser illumination. Both considerations are formalised in 
SSR_D and SSR_E below. The import of SSR_D on PARTI behaviour is somewhat subtle, but the up- 
shot is that a threat can only be targeted while the PARTI enjoys command authorisation and that a target 
release message must be sent 1f and when authorisation 1s lost. 


4.4 HAZ_D 


The operational need for the laser to maintain illumination has already been considered above. The 
safety need embodied by HAZ_D is essentially to ensure that the homing missile is guided away from 
friendly objects. 


While the PARTI is targeting a threat, it must maintain illumimation on the threat. This is formalised 
in SSR_D below. 


The times at which the PARTI 1s considered to be targeting a threat are formalised in SSR_B, SSR_D, 
and SSR_E below. 


4.5 HAZE 


The accident scenarios arising from HAZ_F are essentially those that may occur during properly 
authorised operation, with the distinction that many operational mitigations will (by definition) not be in 
place. This situation is depicted in Figure 7 by the use the “cloud bubble” to represent the repetition of 
the operational accident scenarios. 
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The aim of the safety architecture is to provide protective measures and redundancy to a degree 
appropriate to the identified dangers and in light of the associated costs and benefits. We explain and 
justify these measures by consideration of the respective SSRs. 


53.1 Safety features of the architecture 


SSR_A 


The PAR subsystem is required to protect designated prohibited areas. In support of this, we separate 
the PAR into two components, an actuator component PAR providing the core functionality and an elec- 
tronic control component PARC for directing the behaviour of the PAR. Both components are required 
to protect the prohibited areas, the PARC by directing the PAR beams so as to avoid the prohibited areas 
and the PAR by disabling any beams that are directed toward a prohibited area. 


Also of concern is the potential for the wrong prohibited areas to be transmitted to the PAR sub- 
system. [his is guarded against by the vigilance of the operator component OP in checking feedback 
of the set areas on the operator display maintained by the operator interface OPE. It is assumed that the 
prohibited areas are static over time frames in the order of minutes to hours, so that this task 1s humanly 
feasible. 


A possible enhancement of this operator function would be to also provide display feedback of the 
actual pattern of radar beams, but it is not thought that the added complexity and cost is justified given 
the strong potential for common-mode failures of the PAR subsystem in the directing and reporting of 
the beams. The fielding of a completely independent radar sensor array is obviously infeasible. 


SSR_B 


The Laser subsystem is required not to illuminate any friendly objects. 


The primary responsibility for ensuring this, is invested im the Control subsystem as it can only 
be performed successfully in the presence of comprehensive situational awareness and may in some 
situations require co-ordination with the SAM system. As a redundancy measure, the Control subsystem 
is partitioned into an electronic command and control component and an operator component, supported 
by an operator interface component. 


The ‘Target Discrimination and Selection (1DS) component directs the targeting tasks of Laser sub- 
system, ensuring that the Laser is only directed to illumimate valid threats and ensuring that, when a 
friendly object interferes with line-of-sight to the target, illumination 1s ceased and a target release mes- 
sage set. 


As a protective measure, the OP component is provided with appropriate Laser targeting feedback 
on the track display and is provided with controls for disabling any laser beam that is threatening to 
illuminate a friendly object. The task of responding to an operator cut-off command 1s distributed to 
both the LASC and the LAS components, providing some further measure of redundancy. The TDS 
component also responds by sending an appropriate target release message. 
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SSR_C 


The targeting sequence is commenced when the OP component, having determined the existence 
and position of a threat, orders the PARTI to begin targeting the threat. The TDS component responds 
by checking that the object to be targeted is indeed a valid threat. If so, it sends a target acquire message 
and orders the Laser subsystem to commence illumination of the target. 


The main alternatives to this approach would be to allow the TDS full autonomy in target selection or 
to provide a more elaborate operator-based target selection protocol, perhaps requiring concurrence from 
multiple operators. The first alternative may be forced in an environment where threat response times 
are required to be significantly less than a few seconds, but the added protection of operator imitation 1s 
considered valuable in the specified environment. Equally, a more elaborate operator protocol may be of 
value in an environment where response times measured in minutes are acceptable, but are considered 
an unnecessary overhead in the specified environment. 


SSR_D 


This SSR has two aspects, the requirement to illuminate a target from the time the target acquired 
message is sent and the requirement to send a target release message when illumination ceases, in par- 
ticular when command authorisation is revoked and the PARTI is turned off. 


‘Target illumination is maintained primarily by the LAS component, but it requires control support 
from the LASC component and tracking support from the Radar and Control subsystems. Such dis- 
tributed safety responsibilities are not ideal, but are clearly necessary in this case as the function abso- 
lutely requires this situational awareness support. The provision of protective measures or redundancy 1s 
problematic in this case. Multiple redundant lasers could be used, but this is not ideal for the target illu- 
mination function and would still be subject to common-mode failures in the control support functions. 


The transmission of target release messages is the primary responsibility of the 1DS component. 
There is no practicable method of providing redundancy in this function. 


SSR_E 


The primary responsibility for detect loss of line-of-sight to a target lies with the TDS component, 
with support from the Radar subsystem in providing situational awareness. As a protective measure, the 
OP is given the ability to disable lasers that threaten to illuminate a friendly. 


SSR 


The primary responsibility for shutdown when command authorisation 1s revoked is given to the OP 
component. Shutdown is achieved by removing power from the subsystems. 
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